From 73a7f8a5f2cef8f8e8e8d2a9a55cdcbe7cabf776 Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Thu, 22 Apr 2021 14:31:36 +0200
Subject: [PATCH] cancel checkout needs confirmation

---
 op/op.CancelCheckOut.php                  |  4 ++++
 views/bootstrap/class.CheckInDocument.php | 14 ++++++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/op/op.CancelCheckOut.php b/op/op.CancelCheckOut.php
index c3a1ce270..bed1b5013 100644
--- a/op/op.CancelCheckOut.php
+++ b/op/op.CancelCheckOut.php
@@ -41,6 +41,10 @@ if(empty($settings->_enableCancelCheckout)) {
 	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("operation_disallowed"));
 }
 
+if(empty($_POST['confirm'])) {
+	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("operation_disallowed"));
+}
+
 $document->cancelCheckOut($comment);
 if (is_bool($result) && !$result) {
 	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("error_occured"));
diff --git a/views/bootstrap/class.CheckInDocument.php b/views/bootstrap/class.CheckInDocument.php
index b1c728d21..6654af4f9 100644
--- a/views/bootstrap/class.CheckInDocument.php
+++ b/views/bootstrap/class.CheckInDocument.php
@@ -698,7 +698,16 @@ $(document).ready(function() {
 <form class="form-horizontal" action="../op/op.CancelCheckOut.php" method="post">
 	<input type="hidden" name="documentid" value="<?php print $document->getID(); ?>">
 <?php
-	echo createHiddenFieldWithKey('cancelcheckout');
+			echo createHiddenFieldWithKey('cancelcheckout');
+			$this->formField(
+				getMLText("checkout_cancel_confirm"),
+				array(
+					'element'=>'input',
+					'type'=>'checkbox',
+					'name'=>'confirm',
+					'value'=>1
+				)
+			);
 			$this->formSubmit(getMLText('cancel_checkout'));
 ?>
 </form>
@@ -710,7 +719,8 @@ $(document).ready(function() {
 <form action="../op/op.CancelCheckOut.php" method="post">
 	<?php echo createHiddenFieldWithKey('cancelcheckout'); ?>
 	<input type="hidden" name="documentid" value="<?php print $document->getID(); ?>">
-	<input type="submit" class="btn" value="<?php printMLText("cancel_checkout"); ?>">
+	<input type="hidden" name="confirm" value="1">
+	<input type="submit" class="btn btn-danger" value="<?php printMLText("cancel_checkout"); ?>">
 </form>
 <?php
 		}